Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

An Iranian MOIS-linked APT cluster called Cavern Manticore is using a newly documented modular command-and-control framework (Cavern/Cav3rn) to target Israeli organizations and IT providers via a SysAid DLL side-loading supply-chain compromise; the framework uses mixed .NET compilation formats, loads modular post-exploitation DLLs (mhm.dll, db.dll, ode.dll, n-ten.dll, n-sws.dll), and has been observed performing reconnaissance, credential access, tunneling, lateral movement, and data exfiltration.